Microsoft Takes Down USDT-Phishing Network Targeting 75,000 Firms Worldwide

Microsoft and cybersecurity group Health-ISAC secured a US court order to seize and redirect domains supporting YAM Store, CoGUI, and Iron Man, three services that sold stolen credentials and phishing tools to fraudsters. The disruption targeted a network that accepted Tether’s USDT and Ethereum to facilitate over 1 billion malicious messages worldwide this year.

Scope of the Disruption

According to a statement released on Oct. 14, the company disabled more than 20,000 accounts linked to YAM Store. Investigators are continuing to block more than 100,000 impersonation and fraud domains. Since January, the services helped criminals send messages targeting more than 75,000 organizations across more than 150 countries. The operations generated tens of millions of dollars for their operators.

The investigation began after Japan’s National Police Agency alerted Microsoft to scams targeting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could purchase the infrastructure needed to run phishing operations without building it themselves. This market served as a hub for buying ready-made tools, allowing attackers to launch complex campaigns with minimal technical overhead.

Supplier Roles and Payment Methods

YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations. They used these seemingly legitimate websites to obtain Microsoft 365 accounts for resale. YAM Store also maintained a sub-reseller tier, which expanded the distribution of accounts and infrastructure beyond its own storefront.

CoGUI and Iron Man supplied ready-made phishing pages and messages that mimicked banks, retailers, transport authorities, and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates. These templates allowed customers to tailor scams to specific brands and countries. The variety of templates enabled fraudsters to impersonate a wide range of trusted entities, increasing the likelihood of successful credential theft.

Microsoft’s technical investigation found that the services accepted cryptocurrency, including Tether’s USDT and Ethereum. YAM Store’s storefront supported USDT on the Tron network alongside Alipay and WeChat Pay. Cloudflare stated that buyers could also pay for marketplace offerings with USDC. These multiple payment channels gave customers several options to buy compromised credentials and phishing services, making the financial trails harder to track for law enforcement.

Enforcement and Asset Freezing

Blockchain analytics firm TRM Labs said its intelligence helped investigators locate assets linked to the group and freeze them. The company did not specify the value of the frozen assets. This lack of transparency leaves the operation’s immediate financial damage unclear. While the seizure of domains and accounts disrupts current operations, the frozen assets represent a partial recovery of the illicit funds generated by the network.

The enforcement effort also targeted services criminals used after making their purchases. Cloudflare suspended accounts, disabled Workers projects supporting phishing pages, and banned hundreds of associated domains and projects. It placed warning pages in front of malicious links where it could not seize domains directly. This approach allowed Cloudflare to mitigate harm even when legal jurisdiction over the domain registrars was limited.

Microsoft identified a specific dependency in Iron Man’s subscription business. Customers bought access to phishing software connected to a vendor-controlled licensing server. Disabling that infrastructure could interfere with customers’ ability to use purchased kits, even if copies of the software remained in circulation. This technical takedown aims to render previously purchased tools useless, reducing the return on investment for the criminal groups.

The crackdown involved Japan’s police and Cybercrime Control Center, along with Oracle, Proofpoint, Resecurity, and US law-enforcement partners. Microsoft stated that the targeted suppliers were part of a larger criminal network. Related infrastructure is still being removed. The next challenge is limiting how quickly suppliers can replace seized domains and compromised accounts. Some domain registrars operate in jurisdictions that make legal seizures difficult. Cloudflare must block access through security warnings even as those domains remain online. The ongoing removal of related infrastructure indicates that the disruption is a continuous process rather than a single event.